Stage 59 — PWA API Client Foundation

Adds pwa/api-client.js, a small browser-side fetch wrapper for future authenticated PWA/API screens.
- Uses same-origin credentials.
- Sends JSON Accept, X-Requested-With, X-Request-ID and Cache-Control: no-store.
- Uses fetch cache: no-store and never writes access/refresh tokens to localStorage/sessionStorage.
- Supports GET and JSON POST helpers, timeout handling, network-error normalization and API request-id capture.
- Loaded by the PWA shell.
- Does not change the service worker cache policy; API/private routes remain excluded.
- No database changes. No SQL import.

Correction: Stage 59 test now recognizes the API client script at ./api-client.js relative to pwa/index.php.